fix: fix permissions on cli workflow (#1954)
ci expected to fail, have to merge to actually test
Michael Smith committed
May 4, 2026 at 10:43 UTC
776a19dd0b8fc6a445a8d7d5088a95e687c9b9a0
2 files changed
+16
-2
.github/workflows/update-cli.yml
+8
-1
@@ -11,6 +11,8 @@ jobs:
11
update-cli:
12
outputs:
13
has_changes: ${{ steps.status.outputs.has_changes }}
14
+ permissions:
15
+ contents: write
16
name: Update CLI
17
if: github.repository_owner == 'npm'
18
runs-on: ubuntu-latest
@@ -43,7 +45,7 @@ jobs:
45
id: status
46
run: |
47
if [ -n "$(git status --porcelain)" ]; then
46
- echo "::set-output name=has_changes::1"
48
+ echo "has_changes=1" >> "$GITHUB_OUTPUT"
49
fi
50
- name: Check in source updates
51
if: steps.status.outputs.has_changes == '1'
@@ -55,4 +57,9 @@ jobs:
57
publish:
58
needs: update-cli
59
if: needs.update-cli.outputs.has_changes == '1'
60
+ permissions:
61
+ contents: read
62
+ pages: write
63
+ id-token: write
64
+ actions: read
65
uses: ./.github/workflows/publish.yml
cli/scripts/template-oss/update-cli-yml.hbs
+8
-1
@@ -9,6 +9,8 @@ jobs:
9
update-cli:
10
outputs:
11
has_changes: $\{{ steps.status.outputs.has_changes }}
12
+ permissions:
13
+ contents: write
14
{{> jobYml jobName="Update CLI" }}
15
- name: Build documentation
16
run: npm run build -w cli
@@ -20,7 +22,7 @@ jobs:
22
id: status
23
run: |
24
if [ -n "$(git status --porcelain)" ]; then
23
- echo "::set-output name=has_changes::1"
25
+ echo "has_changes=1" >> "$GITHUB_OUTPUT"
26
fi
27
- name: Check in source updates
28
if: steps.status.outputs.has_changes == '1'
@@ -32,4 +34,9 @@ jobs:
34
publish:
35
needs: update-cli
36
if: needs.update-cli.outputs.has_changes == '1'
37
+ permissions:
38
+ contents: read
39
+ pages: write
40
+ id-token: write
41
+ actions: read
42
uses: ./.github/workflows/publish.yml